HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure

HTTP2Shell, also known as CVE-2026-111497, is a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. This vulnerability, discovered by OpenAI researchers in February 2026, has been patched in Node.js versions 22.23.4, 24.22.1, 26.12.1, and Brotli versions 1.0.10, 1.1.1, and 1.2.1. The issue arises when the decoder attempts to write beyond its allocated memory space, potentially leading to denial of service, memory disclosure, or remote code execution.

The exposure of the vulnerability depends on whether software decompresses untrusted Brotli data. For WordPress and WooCommerce sites, the risk primarily stems from PHP applications and extensions handling untrusted Brotli data. Node.js applications and self-hosted Next.js sites are also at risk if they decompress attacker-controlled Brotli data. Apache HTTP Server and Vercel-hosted Next.js sites are not directly affected.

While WordPress core and PHP core are not explicitly mentioned in the advisories, it is still crucial to review custom PHP extensions and third-party libraries for potential vulnerabilities. Linux distribution package statuses vary, so it is essential to check each distribution's patched versions. Vercel manages patched Node.js runtimes for Vercel-hosted Next.js sites. To mitigate the risk, update affected runtimes and libraries, and temporarily block incoming Content-Encoding: br requests until patches are applied.